Critical Security Flaw in Marimo Notebook
Code injection vulnerability allows attackers to execute commands.
1Critical Vulnerability in Marimo Notebook
A high-severity security flaw was discovered in Marimo's notebook software, allowing attackers to execute Model Context Protocol (MCP) commands through a specially crafted notebook. This vulnerability can run as a local subprocess when the notebook is opened in edit mode. The flaw, tracked as CVE-2026-75149, has a CVSS v4 score of 8.7.
2Affected Versions and Fix
The security vulnerability affects Marimo versions prior to 0.23.15. The company addressed the issue in version 0.23.15 and recommended users to upgrade. The vulnerability was published in August 2026, and users are advised to move away from affected versions. Marimo provides security patches only for the latest stable release.
3Discovery and Confirmation
The security flaw was discovered by Gregory Tan (Grg0rry) and was also addressed during Marimo's PEP 723 hardening process. Additionally, a similar configuration boundary was discussed in VulnCheck's separate CVE-2026-67618 advisory. This flaw involves an AI-based attack affecting Marimo versions prior to 0.23.15.
4Previous Security Vulnerabilities
CVE-2026-75149 is separate from Marimo's earlier CVE-2026-39987 vulnerability. The previous flaw arose due to a lack of authentication on the /terminal/ws endpoint, allowing attackers to gain full PTY shell access. This issue was resolved in Marimo's version 0.23.0.
5Patch and Security Policy
Marimo quickly addresses security vulnerabilities to ensure user safety. The company provides security patches only for the latest stable release and encourages users to stay updated. Additionally, Marimo's PEP 723 hardening process treats notebook metadata as attacker-controlled and passes it through an allowlist.
6AI's Role and Security
Artificial intelligence (AI) helps teams ship code 10-50 times faster, but security measures must keep pace. This session provides a practical roadmap to strengthen visibility, response, and remediation. AI can find and chain vulnerabilities in minutes, posing new challenges for security teams.
7Attackers' Target
Attackers can execute MCP commands through specially crafted notebooks, gaining control over systems. These commands run as local subprocesses when the notebook is opened in edit mode, allowing attackers to take control. Such attacks pose a significant threat, especially to AI-based systems.
8Conclusion and Importance
The security flaw discovered in Marimo Notebook highlights the critical nature of code injection attacks. Users must upgrade to the latest versions and apply security patches promptly. AI's ability to quickly find vulnerabilities requires teams to take more proactive measures.
Original article: The Hacker News — Marimo Notebook'ta Kritik Güvenlik Açığı